So first, let's clear the screen.
As you may have heard me say before, there are many vulnerabilities in Métis portable three.
I'll try to cover the majority of them.
So this way you can go deeper into the machine when you want to, but I'll show you how to get their
methodology will pretty much be the same.
First, I'll look at the services to find vulnerabilities by searching on the Nessa's scan.
Or you can always use a search engine.
So let's get started.
First, I need to list services.
And assorted list will be better, that's sorted, not sorted.
Services, oh, too, so this is going to list services due on the second column.
And there are a lot of services here, so let's be more selective, shall we?
So you remember that you've enumerated the assembly services before and I get to focus on this board
for four or five.
And let's hope Nessa's find something for these Borz.
And yeah, you have.
So you might remember, too, that this number that you have discovered, you got it.
So there's an exploit for this as well.
Searching with a severe number or with this number?
And.
Whichever you do, the result is the same.
Right, so here are the modules related to that vulnerability.
And actually, if you did read about or if you will read about this particular vulnerability, you will
see that this is why the NSA even uses.
National Security Agency, that is so I will use that exploit.
Ms.
One seven zero one zero eternal blup.
Show me the options.
And the target is the same man, exploitable three set our host to tend, tend to not tend and everything's
set except for the payload.
So show payloads to select a suitable payload.
Now, because our target is 64 bit, you can choose 64 bit reverse temperature payload.
So let's set our host to your colleague machine.
And I'm going to set airport two four four, four, five.
And let's see the options again.
Nothing to change here, so let's exploit.
And everything looks to be quite OK.
And the interpreter shall open finally.
The shell, you see has higher privileges.
And on the other hand, I want you to be able to clarify this vulnerability.
Sometimes when you try this exploit, you might confront a few problems.
And sometimes if you want to exploit this vulnerability again.
It doesn't get a shell or it can come up with other problems.
So what to do in a situation like that?
Sometimes you just got to shut down the machine and you can restore it from one of the snapshots.
Remember, that's one of the things we addressed earlier when you're setting up instead of being so
eager to just get in and do it.